Remote LSASS Memory Dump via SMB

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.